HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-108550 — SkillHub before 0.2.22 contains an incorrect authorization vulnerability in Acco...

·Source: NIST NVD

Updated:

Executive Summary

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens

Analysis

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership. CVSS Score: 8.8. Published: 2026-10-10T15:16:58.133.

Indicators of Compromise (1)

CVE (1)
CVE-2026-108550
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 10, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

PHP warns admins of two critical flaws, emergency patches coming tomorrow

The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. [...]

BleepingComputer
MEDIUMVulnerability

Nigerian sentenced to 8 years for long-running tax business hacking and fraud scheme

Chukwuemeka Victor Amachukwu hacked tax preparation businesses, filed false tax returns and enticed victims to send him money for investment schemes. The post Nigerian sentenced to 8 years for long-running tax business hacking and fraud scheme appeared first on CyberScoop .

CyberScoop
MEDIUMVulnerability

Zeabur shutting down after second security breach in two months

Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts. [...]

BleepingComputer